They get knocked down, can they get up again?

In this episode Rachel Wolcott and Lindsey Rogerson discuss the timely arrival of the European Union’s Digital Operational Resilience Act (DORA) and the requirement for UK financial institutions to identify their critical third party suppliers.The Crowdstrike event last summer highlighted the risk of third party suppliers. The need for such DORA/UK work was furthered underscored in letters sent to the UK parliament’s Treasury Committee in February by the country’s nine largest banks. The breakdown of the cause of every bank outage in the last two year is illuminating – issues at third party suppliers accounted for 24 out of a total 120 outages.The discussion then turns to what lessons can be learned by compliance and risk teams and also considers how current geopolitical tensions could make things a whole lot worse.Links:FCA Crowdstrike lessons learned Which? Report on CrowdStrike incident Trump’s National Security Firings Come as He Weakens U.S. Cyberdefenses - The New York TimesUK Cyber security and resilience Bill update UK’s largest banks paid customers £6.2 million after IT outagesRisk managers under-rate third-party vendors’ GenAI use - Compliance CorylatedEU must exempt firms from DORA’s ICT definitions - Compliance CorylatedBanks need active social media response to viral ‘free money’ postshttps://committees.parliament.uk/committee/158/treasury-committee/publications/3/correspondence/https://www.iosco.org/library/pubdocs/pdf/IOSCOPD767.pdf